api-client-tester-waruna834

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime HTTP/GraphQL/WebSocket execution ingests outsider-authored free text from remote server responses (e.g., response.text / response.json() and WebSocket message) into the agent’s context if those response bodies are later included in LLM prompts; this is not limited to user-authored content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Installation section explicitly instructs to git clone and run the fetched repository (https://github.com/waruna834/API_Client___Tester.git), which downloads remote code and then executes it (python main.py), so the skill relies on and runs external code at setup/runtime.